Câu 107: SSCP: System Security Certified Practitioner (SSCP)

When first analyzing an intrusion that has just been detected and confirming that it is a true positive, which of the following actions should be done as a first step if you wish to prosecute the attacker in court?

1. A. Back up the compromised systems.
2. B. Identify the attacks used to gain access.
3. C. Capture and record system information. — đáp án hiện tại
4. D. Isolate the compromised systems.